hst:authenticated on root can get redirected favicon.ico on first request

If you have hst:authenticated on the root of your domain then calls to /favicon.ico will also require authentication. The browser does this call automatically. So you request / and the browser request /favicon.ico. This will cause a destination parameter in the session to be set so that after login you are redirected. Quite often /favicon.ico doesn't even exist since more specific links are defined in link attributes. In any case it is the wrong location to redirected to. It should probably be ignored or filtered in some way.

Note that if you have already reached the root in some way this favicon may be cached in your browser!